As reported by The Hacker News, a critical vulnerability in Apache HTTP Server's mod_http2 module permits unauthenticated remote code execution against any reachable server with HTTP/2 enabled. Tracked as CVE-2026-119618 and rated 9.8 CVSS Critical, this flaw affects Apache HTTP Server 2.4.55 through 2.4.70 and the standalone mod_h2 builds 2.0.8 through 2.0.42. A fix is available in Apache HTTP Server 2.4.71, released November 11, 2026.

Security Impact: As reported by The Hacker News, a critical vulnerability in Apache HTTP Server's mod_http2 module permits unauthenticated remote code execution against any reachable server with HTTP/2 enabled.

What makes this vulnerability particularly dangerous is the combination of three factors: it requires no authentication, it affects the default configuration when HTTP/2 is enabled, and public research has already demonstrated a reliable exploit. While Wiz reports no confirmed exploitation in the wild at publication time, the gap between proof-of-concept and mass exploitation has been shrinking consistently. Organizations running internet-facing Apache servers with HTTP/2 cannot afford a delayed response.

Vulnerability Snapshot

FieldDetail
CVECVE-2026-119618
CVSS9.8 (Critical)
Affected Componentmod_http2 (Apache HTTP Server), mod_h2 (standalone)
Affected VersionsApache HTTP Server 2.4.55–2.4.70; mod_h2 2.0.8–2.0.42
Fixed VersionApache HTTP Server 2.4.71
Red Hat Fix (RHEL 9)mod_http2-2.0.26-7.el9_9.1 (RHSA-2026:98981)
Red Hat Fix (RHEL 10)mod_http2-2.0.29-5.el10_3.1 (RHSA-2026:98978)
Not AffectedRHEL 6, 7, 8 (no vulnerable code present)
Exploitation in WildNot yet confirmed; reliable PoC research exists
PrerequisitesHTTP/2 enabled (Protocols directive: h2 or h2c), unauthenticated network access

Why This Matters More Than a Typical RCE

Apache HTTP Server remains the most widely deployed web server software globally, and HTTP/2 adoption has accelerated significantly as organizations move away from HTTP/1.1 for performance gains. The attack surface for this vulnerability is therefore enormous. The critical nuance is that HTTP/2 can be enabled at the server level or per virtual host via the Protocols directive — meaning administrators must audit every virtual host configuration, not just the global setting, to determine exposure accurately.

Red Hat's severity downgrading to Important on RHEL 9 and 10 is worth noting. Their mod_http2 packages implement per-stream memory allocators, which complicates exploitation. However, this is a hardening measure, not a complete fix — determined adversaries may still find a path. Organizations should not treat RHEL's Important rating as permission to deprioritize patching.

Who Is at Greatest Risk

Why This Matters More Than a Typical RCE
Internet-facing Apache deployments with HTTP/2 enabled on ports 80/443 — the primary target for opportunistic and automated exploitation
Cloud-hosted web servers where HTTP/2 is often enabled by default in load balancer or CDN configurations that proxy to Apache backends
API gateways and reverse proxies using Apache with HTTP/2 passthrough — if the backend speaks h2c, it may be exploitable even behind TLS-terminating frontends
Standalone mod_h2 users who compiled or installed the module outside of their distribution's package manager and may miss automatic updates

Shield53 Recommendations — Immediate Actions

  1. Patch immediately. Upgrade to Apache HTTP Server 2.4.71. On RHEL 9/10, apply the appropriate RHSA advisory via yum update mod_http2 or dnf update mod_http2. Reboot or restart httpd afterward.
  2. If patching is delayed, disable HTTP/2. Remove or comment out Protocols h2 h2c directives across all virtual hosts and the global configuration. Restart httpd. This is a safe rollback — HTTP/1.1 remains fully functional. Prioritize this for internet-facing servers.
  3. Audit every virtual host. Run apachectl -t -D DUMP_VHOSTS and grep configurations for Protocols directives at any scope. Do not assume HTTP/2 is off just because you didn't explicitly enable it — some distribution defaults include it.
  4. Deploy WAF rules. If your WAF supports HTTP/2 inspection, add rules to detect and block anomalous HTTP/2 frame patterns. While no specific detection signatures exist yet, monitoring for unusual stream multiplexing behavior or oversized header frames may catch early exploit attempts.
  5. Hunt for indicators of compromise. Review httpd process behavior for unexpected child processes, outbound connections, or file writes in the web root. Check for persistence mechanisms in cron, systemd, or startup scripts if exploitation is suspected.
  6. Inventory and verify. Enumerate all Apache HTTP Server instances across on-prem, cloud, and container environments. Confirm the running version against the affected range. Containerized deployments using base images with Apache 2.4.55–2.4.70 must rebuild and redeploy.
The presence of reliable public exploit research before patches reached broad distribution is the signal that matters most. Treat this as a race condition — every hour unpatched is an hour of unnecessary exposure to automated scanning infrastructure that is already probing for this exact flaw.

This vulnerability also serves as a reminder that performance-enhancing features like HTTP/2 carry security trade-offs. Organizations should formalize a policy for evaluating protocol-level changes in their web server stack, including a security review checkpoint before enabling new protocol modules in production. The cost of that review is trivial compared to the cost of an unauthenticated RCE on your edge.